ConsolidatedWMIEvidence Template

ConsolidatedWMIEvidence provides a simpler interface to specify Windows Management Instrumentation (WMI) properties on computers. Other Web-Based Enterprise Management (WBEM) properties are supported from Unix computers as well. The most important data to provide in this spreadsheet is operating system installs. The ‘Win32_OperatingSystem’ class and the ‘Name’ property contains this data.

Table 1. Columns included with ConsolidatedWMIEvidence templates

Column

Details

ComputerID

Type: big integer. Key

The identifier used in the source connection for the computer. It must match the ComputerID from the Computer spreadsheet or the row will be ignored.

Destination:

ImportedInstalledWMIEvidence.ExternalComputerID

ClassName

Type: text (max 50 characters). Key

The WMI class name of the evidence. An example is ‘Win32_OperatingSystem’.

Destination:

ImportedWMIEvidence.ExternalEvidenceID

ImportedWMIEvidence.ClassName

ImportedInstalledWMIEvidence.ExternalEvidenceID

PropertyName

Type: text (max 50 characters). Key

The WMI property name of the WMI evidence. An example is ‘Name’.

Destination:

ImportedWMIEvidence.ExternalEvidenceID

ImportedWMIEvidence.PropertyName

ImportedInstalledWMIEvidence.ExternalEvidenceID

PropertyValue

Type: text (max 256 characters). Key

The value of the property of the WMI evidence. An example is ‘Microsoft Windows 7 Enterprise’

Destination:

ImportedWMIEvidence.ExternalEvidenceID

ImportedWMIEvidence.PropertyValue

ImportedInstalledWMIEvidence.ExternalEvidenceID

InstanceName

Type: text (max 256 characters). Key. Nullable

The name of the WMI class instance. This is important when there a multiple instances of a WMI class on a computer. An example is the ‘Win32_VideoController’ class that may have many instances with the same properties. In this case you need to specify the name of the instance here, ‘Intel(R) HD Graphics Family’ or ‘NVIDIA Quadro K2100M’ for example.

Destination:

ImportedWMIEvidence.ExternalEvidenceID

ImportedInstalledWMIEvidence.ExternalEvidenceID

ImportedInstalledWMIEvidence.InstanceName